CVE-2018-1081

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-04-04 · updated 2026-06-17
Weakness: CWE-79

Description

A flaw was found in Moodle 3.4 to 3.4.1, 3.3 to 3.3.4, 3.2 to 3.2.7, 3.1 to 3.1.10 and earlier unsupported versions. Unauthenticated users can trigger custom messages to admin via paypal enrol script. Paypal IPN callback script should only send error emails to admin after request origin was verified, otherwise admin email can be spammed.

Affected products

Moodle: through 3.0.10; from 3.1 through 3.1.10; from 3.2 through 3.2.7; from 3.3 through 3.3.4; from 3.4.0 through 3.4.1

References

http://www.securityfocus.com/bid/103728
https://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-61392
https://moodle.org/mod/forum/discuss.php?d=367938
http://www.securityfocus.com/bid/103728
https://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-61392
https://moodle.org/mod/forum/discuss.php?d=367938

Get alerted when CVE-2018-1081 or the next vulnerability affects your stack